Six Grim(m) Security Fairy Tales

Keeping these security fairy tales in mind will help you keep your security priorities straight.

Information security mistakes are costly, damaging, and all too
prevalent. Given the repercussions of poor security strategies (see
recent incidents from organizations like TJX, AOL and the VA), one
is inclined to believe change agents are in place.

However, organizations continue to drive their security efforts
based on fallacies and myths, and make seemingly avoidable mistakes
when it comes to information security. I'll present six
common myths, in no particular order:

• Network Defenses will Protect your Kingdom

• Technology/Tools are the Panacea

• Only "Bad" People are Bad

• Security ROI is the Beacon

• Secure Software is Costly

• The Security Breach du Jour is the Most Pressing

1) Network Defenses Protect Your Kingdom

The problem isn't our networks (which are pretty well
protected, by the way). It's the crappy software we write and
put on the network.

There is no discipline or rigor to software engineering like
there is in other engineering disciplines. I'm a mechanical
engineer by trade with certifications that verify my expertise in
this craft. There is no correlation in the software world and we,
as organizations that build and buy software, aren't
demanding a change.

Network defenses, like firewalls and intrusion prevention
systems, have a place in a multi-layered information security
solution, but they can't protect us from the majority of
vulnerabilities – those in the application layer.

2) Technology/Tools are the Panacea

I love tools. I worked for a software testing tools vendor for
more than five years. But I also recognize that tools alone
don't make people smarter, nor do they improve the process
through which solutions are built. They simply make people and
processes more efficient in jobs they are trained to do.

Tools don't teach a surgeon how to operate. I didn't
become a better mechanical design engineer because I learned how to
use AutoCAD; it just made me more efficient in the job I was
already trained to do. That's the problem. There is no
training in the application development discipline and no rigor in
holding teams accountable to maintaining secure infrastructures.
Tools have their place in a complete information security workflow
but they require people who know how to operate them to be
effective.

3) Only "Bad" People are Bad

Causal hackers aren't the real threat. Hackers actually
help trip landmines that are waiting to be exploited.

The real threats are organized hackers (think terrorist cells or
enemy states) who could cripple our infrastructure, utilities and
communication systems. Real threats are insiders who already have
access and know where the crown jewels are. Companies focus on
hackers but that is the wrong assumption. And they always forget
that it's their poorly-written software that allows the
hackers to exploit them in the first place. Fix the problem (bad
software) and you mitigate the threats.

4) Security ROI is the Beacon

A recent Gartner survey noted that 25% of organizations are
looking for a specific return on investment from information
security investments. An additional 27% view it as a cost or risk
avoidance investment, leaving only 48% of organizations that view
security investments as a cost of doing business.

Until organizations let go of the desire to measure security
ROI, they will never be satisfied with any investment therein. Your
applications and data are liabilities, not assets. They are
information security risks and liabilities that need to be
mitigated, not exploited for ROI.

If companies thought about their applications as threats or
liabilities instead of assets they'd treat them a lot
differently, from conception through development and deployment.
Think of security investment like an investment in term life
insurance – you are mitigating risks associated with a
liability, your mortality. We don't die every year, but does
that mean term life insurance is a bad investment?

Ed Adams is CEO of Security Innovation, an independent provider of application security services that include security testing and training.